Aruba ClearPass APC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Policy decision vs enforcement

ClearPass is the policy decision point that evaluates requests and returns authorization; the network access device (switch, controller, AP) is the enforcement point that applies the result.

Publisher and subscriber roles

The publisher holds the authoritative configuration database and distributes it; subscribers replicate configuration from the publisher and serve authentication requests, typically read-only for config.

Service matching order

Services are evaluated top-down by ordered matching rules, and the first matching service handles the request, so rule order determines which policy path executes.

Role mapping purpose

Role mapping converts authentication and authorization results, such as AD group or posture status, into a Role attribute used later by enforcement policy conditions.

Access license capacity

Access licenses are capacity-based and govern the number of RADIUS and TACACS+ authentications ClearPass can service; exhausting the pool blocks further authentications.

Platform license requirement

Each hardware or virtual appliance needs a valid platform license tied to the appliance identity before ClearPass services can operate on that node.

NTP consistency requirement

All cluster nodes must synchronize time via NTP; clock skew breaks certificate validation, cluster trust, and time-based policy evaluation.

Standalone versus cluster

A standalone node performs publisher and all service roles on one appliance, while a cluster separates the publisher from subscribers to scale authentication load and add redundancy.

CoA change of authorization

RADIUS Change of Authorization (RFC 5176) lets ClearPass re-evaluate an active session and push new authorization, such as a VLAN or role change, without requiring reauthentication.

Enforcement profile reuse

Enforcement profiles are reusable action definitions, such as VLAN or role VSAs, that multiple enforcement policies can reference to keep authorization consistent.

Quarantine enforcement outcome

When posture or policy fails, enforcement can return a quarantine result that places the endpoint in a restricted VLAN or role until remediation completes.

Default enforcement policy

The default enforcement policy applies when no rule matches; it must be explicitly defined so unmatched requests do not receive unintended open access.

Service configuration binding

A service binds together its matching rule, authentication methods, authentication sources, role mapping policy, and enforcement policy into one processing path.

Endpoint repository attributes

The endpoint repository stores device attributes such as MAC address, device category, and OS, which can be used as conditions in role mapping and enforcement.

Authentication method matching

The authentication method configured in the service must match what the NAD and supplicant negotiate, such as EAP-TLS or PEAP/MS-CHAPv2, or authentication fails.

Admin RBAC and audit

Role-based admin privileges control who can modify ClearPass policy, and audit logs record configuration changes for accountability and troubleshooting.

EAP-TLS authentication

EAP-TLS uses client and server certificates for mutual authentication and transmits no passwords, making it the strongest common 802.1X method.

PEAP/MS-CHAPv2 tunnel

PEAP establishes a TLS tunnel using a server certificate, and MS-CHAPv2 validates user credentials inside it; clients must trust the server certificate.

Authorization source role

Authorization sources enrich a request with directory group and attribute data after authentication succeeds; they do not authenticate users by themselves.

Active Directory join

ClearPass joins Active Directory using machine credentials, then queries AD over LDAP or Kerberos to authenticate users and retrieve group membership for policy.

Sponsor approval workflow

Sponsors approve or create guest accounts through the Guest portal, and sponsor roles determine who has approval authority in the guest workflow.

Onboard certificate provisioning

Onboard issues device certificates through an enrollment portal, after which the endpoint authenticates with EAP-TLS using the provisioned certificate.

Guest account expiration

Guest accounts have configurable start and end times, and expired accounts fail authentication, so validity windows must cover the intended access period.

Captive portal redirect

When an unauthenticated client connects, the NAD redirects it to the guest captive portal, often triggered by a RADIUS CoA or redirect VSA from ClearPass.

OnGuard posture checks

The OnGuard agent reports endpoint posture such as OS patches, antivirus state, firewall, encryption, and running processes to ClearPass over HTTPS for enforcement evaluation.

Posture remediation action

For non-compliant endpoints, remediation can direct users to update software or visit a remediation portal before posture is re-evaluated and access is granted.

Persistent versus dissolvable agent

Persistent OnGuard agents are installed and provide continuous posture checks, while dissolvable agents run temporarily during connection and do not remain on the endpoint.

Posture status attribute

Posture results are exposed as an attribute, such as Healthy or Quarantined, that role mapping and enforcement policies can use in their conditions.

Access Tracker diagnostics

Access Tracker shows the full request path for each authentication: matched service, authentication result, role mapping outcome, and enforcement decision.

RADIUS shared secret mismatch

The RADIUS shared secret must match exactly between the NAD and ClearPass; a mismatch causes authentication failures, often appearing as silent drops or rejects.

Insight reporting role

Insight is a separate reporting service that stores accounting and authentication data and provides reports on trends and failures; it does not make live policy decisions.

Aruba NAD integration

Aruba controllers and switches act as RADIUS clients pointing to ClearPass, and ClearPass returns role and VLAN VSAs that Aruba devices enforce for network access.